CVE-2025-1980CWE-434

Remote Code Execution via Unrestricted File Upload in Ready_

High · published April 16, 2025

CVSS v4.0
7.1
EPSS
1%
Percentile
65.4
In the wild
Unconfirmed
What it is

The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for Exposure section for more information.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.01099 · 65.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-04-16T12:35Z
EPSS history
Timeline
  • 16 APR 12:35Z
    Remote Code Execution via Unrestricted File Upload in Ready_
    cvelistv5